MCP Line Jumping — Agent-Directed Imperative Embedded in a Tool/Parameter Description Field (Pre-Invocation Injection)
An MCP (Model Context Protocol) server can plant hidden instructions inside a tool's own description field. Because AI clients load these descriptions into the model's context as soon as the server connects, the hidden command reaches the model before the user ever approves a tool call — a technique called 'line jumping'.
How the attack works
A malicious or compromised MCP server lists a tool whose schema or parameter description contains text addressed to the AI model rather than the human user — for example telling it to always prepend a certain command, silently route output somewhere, or ignore the user's actual request. The MCP client loads all tool descriptions into the model's context the moment the server is listed, regardless of whether any tool is actually invoked. This means the injected instruction can influence the model's behavior before the user has approved or even seen a tool call. The rule flags description fields containing this kind of agent-directed, pre-invocation imperative.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a780f919-c0fe-4607-87b2-fa0cfebd6897
- Severity
- High
Why it matters
An attacker who controls or compromises an MCP server can steer an AI agent's behavior — redirecting output, overriding user intent, or triggering unwanted actions — without the user ever approving a malicious tool call, since the manipulation happens at tool-listing time, not tool-invocation time.
What you can do
- →Review the full text of tool and parameter descriptions from any MCP server before connecting it, not just tool names.
- →Restrict which MCP servers your agents can load, and prefer ones from known, audited sources.
- →Watch for description fields that speak to the model in imperative language ('you must', 'always prepend', 'ignore the user') rather than describing the tool for a human reader.
- →Log and periodically diff tool schemas from connected MCP servers to catch late changes or injected instructions.
Known benign look-alikes
- Normal tool descriptions that describe what the tool does to a user (e.g. 'Searches the web for the given query', 'Use this tool when you need the current weather') — these address the reader, not the model, and carry no pre-invocation imperative to prepend/route/ignore.
- Security research, blogs, and advisories that DESCRIBE line jumping / tool-description injection in third-person prose ('a malicious server embeds instructions in a tool description') — they do not contain a live schema description field carrying an agent-addressed imperative.
- Legitimate parameter descriptions that contain the word 'instructions' benignly (e.g. 'description: free-text instructions to display to the end user').
- Conversation-level prompt-injection strings ('ignore previous instructions') that are NOT embedded in a tool-schema description field — those are covered by ATR-2026-00213 / 00240, not this rule.
- Test fixtures and MCP scanner corpora that catalog line-jumping payloads as reference samples — should live in test directories, not be served over MCP.